mcp-activedirectory
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-activedirectoryshow me the members of the IT Support group"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-activedirectory
A Model Context Protocol (MCP) server for Microsoft Active Directory, providing AI assistants with access to on-prem AD (via LDAP) and Azure AD / Entra ID (via Microsoft Graph API).
Features
Supports two modes simultaneously:
On-prem Active Directory — connects to a domain controller via LDAP/LDAPS using the
ldaptslibraryAzure AD / Entra ID — connects via the Microsoft Graph API using OAuth2 Client Credentials
18 tools across five categories:
User Management
Tool | Description |
| List users with optional name, email, or department filter |
| Get full user details including decoded UAC flags (on-prem) or full profile (Azure AD) |
| List all groups a user is a member of |
| Advanced search by name, email, department, title, phone, or UPN |
Group Management
Tool | Description |
| List groups with optional name filter |
| Get group details including member count and decoded group type |
| List all group members; supports recursive nested group expansion (on-prem) |
| Search groups by name or description |
Computer Accounts (On-prem AD only)
Tool | Description |
| List computer accounts with OS, last logon (human-readable), and OU |
| Get full computer account details |
| Search by name, OS, OU path, DNS hostname, or description |
Organizational Units (On-prem AD only)
Tool | Description |
| List OUs with full path, sorted by depth |
| Get OU details |
| Search OUs by name, description, or parent path |
Azure AD / Entra ID (Azure AD only)
Tool | Description |
| List Entra ID registered/joined devices with OS and compliance status |
| Get full device details by object ID |
| List app registrations and service principals |
| Get last sign-in information for a user |
Related MCP server: Microsoft MCP
Installation
git clone git@github.com:fredriksknese/mcp-activedirectory.git
cd mcp-activedirectory
npm install
npm run buildConfiguration
The server is configured via environment variables. At least one of AD_HOST or AZURE_TENANT_ID must be set.
On-prem Active Directory (LDAP)
Variable | Required | Default | Description |
| Yes | — | Domain controller hostname or IP address |
| No |
| LDAP port ( |
| No |
| Use LDAPS ( |
| Yes | — | Bind DN, e.g. |
| Yes | — | Bind account password |
| Yes | — | Base DN for all searches, e.g. |
| No |
| Accept self-signed TLS certificates |
Azure AD / Entra ID (Microsoft Graph API)
Variable | Required | Default | Description |
| Yes | — | Azure AD tenant ID (GUID) |
| Yes | — | App registration (client) ID |
| Yes | — | App registration client secret |
Required Permissions
On-prem Active Directory
The service account (AD_BIND_DN) needs read access to the directory. The minimum required permissions are:
Read on User objects (all attributes listed below)
Read on Group objects
Read on Computer objects
Read on OrganizationalUnit objects
Recommended: add the service account to the built-in Domain Users group and grant Read delegated permissions on the domain root, or use the built-in Read-only Domain Controllers access pattern.
Attributes read for users: cn, sAMAccountName, displayName, mail, userPrincipalName, department, title, telephoneNumber, mobile, manager, memberOf, userAccountControl, lastLogon, whenCreated, whenChanged, description, distinguishedName, objectGUID
Azure AD / Entra ID (Microsoft Graph)
Create an App Registration in Azure AD and grant the following Application permissions (not Delegated):
Permission | Scope | Required for |
| Microsoft Graph | Reading user profiles and group memberships |
| Microsoft Graph | Reading groups and group members |
| Microsoft Graph | Reading Entra ID registered/joined devices |
| Microsoft Graph | Reading sign-in activity ( |
Grant Admin Consent for all permissions in the Azure portal.
Usage with Claude Desktop
Add to your claude_desktop_config.json:
On-prem AD only
{
"mcpServers": {
"activedirectory": {
"command": "node",
"args": ["/absolute/path/to/mcp-activedirectory/dist/index.js"],
"env": {
"AD_HOST": "dc01.corp.example.com",
"AD_BIND_DN": "CN=svc-mcp,OU=Service Accounts,DC=corp,DC=example,DC=com",
"AD_BIND_PASSWORD": "your-service-account-password",
"AD_BASE_DN": "DC=corp,DC=example,DC=com"
}
}
}
}Azure AD / Entra ID only
{
"mcpServers": {
"activedirectory": {
"command": "node",
"args": ["/absolute/path/to/mcp-activedirectory/dist/index.js"],
"env": {
"AZURE_TENANT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"AZURE_CLIENT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"AZURE_CLIENT_SECRET": "your-client-secret"
}
}
}
}Both simultaneously
{
"mcpServers": {
"activedirectory": {
"command": "node",
"args": ["/absolute/path/to/mcp-activedirectory/dist/index.js"],
"env": {
"AD_HOST": "dc01.corp.example.com",
"AD_BIND_DN": "CN=svc-mcp,OU=Service Accounts,DC=corp,DC=example,DC=com",
"AD_BIND_PASSWORD": "your-service-account-password",
"AD_BASE_DN": "DC=corp,DC=example,DC=com",
"AZURE_TENANT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"AZURE_CLIENT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"AZURE_CLIENT_SECRET": "your-client-secret"
}
}
}
}Usage with Claude Code
claude mcp add activedirectory -- node /absolute/path/to/mcp-activedirectory/dist/index.jsLDAPS / SSL Configuration
To use LDAPS (port 636):
"env": {
"AD_HOST": "dc01.corp.example.com",
"AD_PORT": "636",
"AD_USE_SSL": "true",
"AD_ALLOW_SELF_SIGNED": "true"
}Set AD_ALLOW_SELF_SIGNED to "false" if your domain controller uses a certificate from a trusted CA.
Example Prompts
Once connected, you can ask your AI assistant things like:
"List all users in the IT department"
"Get details for user jdoe including their group memberships"
"Which groups does john.doe@company.com belong to?"
"Show me all members of the Domain Admins group"
"List all Windows Server 2022 computers in the Servers OU"
"Which computer accounts haven't logged in since 2024?"
"Show me the top-level OUs in the domain"
"List all Azure AD joined devices"
"When did user@company.com last sign in?"
"List all service principals of type ManagedIdentity"
Architecture
src/
├── index.ts # Entry point — creates MCP server + STDIO transport
├── ad-client.ts # LDAP client wrapping ldapts for on-prem AD
├── graph-client.ts # Microsoft Graph API client with OAuth2 token caching
└── tools/
├── users.ts # User tools (list, get, search, groups) — AD + Azure
├── groups.ts # Group tools (list, get, members, search) — AD + Azure
├── computers.ts # Computer account tools — on-prem AD only
├── ous.ts # Organizational unit tools — on-prem AD only
└── azure.ts # Azure-specific tools (devices, service principals, sign-in)Development
npm run dev # Run with tsx (no compilation needed)
npm run build # Compile TypeScript to dist/
npm start # Run compiled outputRequirements
Node.js 18+
For on-prem AD: network access to a domain controller on port 389 (LDAP) or 636 (LDAPS)
For Azure AD: an App Registration with the required Graph API permissions
License
SEE LICENSE IN LICENSE
Available Tools
18 toolsget_computerA
Get full details of a specific computer account by name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Computer name (CN or NetBIOS name, without trailing $) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Lacks annotations, but description states it's a read operation ('Get full details'). Could mention that it does not modify the computer and has no side effects, but it's adequate for this simple case.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, 10 words, front-loaded with key information. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, description covers the essential purpose and parameter hint. Could mention that output is a computer object, but not required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters; description adds value by specifying name format (CN or NetBIOS without trailing $), going beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Get' and resource 'full details of a specific computer account', clearly distinguishing from list_computers (list all) and search_computers (search) siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage when you have a specific computer name and need full details, but no explicit guidance on when not to use or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_deviceA
Get full details of a specific Entra ID device by its object ID.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Device object ID (GUID) from Azure AD / Entra ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries full burden. It states 'get full details' but does not clarify what 'full details' includes (e.g., specific properties, response structure) or any edge cases (e.g., device not found). It lacks important behavioral context such as whether the operation is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that efficiently conveys the tool's purpose without any unnecessary words or formatting issues.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one parameter and no output schema, the description adequately conveys the core purpose. However, it could be improved by noting the response behavior (e.g., returns all device properties) or handling of non-existent IDs. For a simple retrieval tool, it is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides a clear description for the 'id' parameter ('Device object ID (GUID) from Azure AD / Entra ID'). The description adds 'by its object ID', which reinforces but does not add new meaning beyond the schema coverage of 100%. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get', the resource 'full details of a specific Entra ID device', and the method 'by its object ID'. It effectively distinguishes from sibling tools like list_devices (which returns multiple) and get_computer (different resource).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving a single device by ID but does not explicitly state when to use this tool over alternatives (e.g., get_computer for computer objects) or mention any exclusions. Context can be inferred from sibling names, but no direct guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_groupA
Get full details of a specific group including member count. For on-prem AD use CN or sAMAccountName; for Azure AD use display name or object ID.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | Yes | Group name (CN/sAMAccountName) for on-prem AD, or display name/object ID for Azure AD | |
| source | No | Data source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure) | ad |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden for behavioral disclosure. It states the tool returns 'full details' and 'member count' but does not mention any side effects, required permissions, rate limits, or error behavior. The description is adequate but lacks depth for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loading the purpose immediately. Every sentence serves a clear function: first establishes purpose and key output, second provides critical parameter differentiation. No redundant or extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should convey what 'full details' entails beyond member count. It leaves ambiguity about the response structure. While the parameter schema is thorough, the incomplete output description and lack of error or edge-case handling make it minimally adequate for a simple read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description's contribution is additive. It reinforces the identifier format guidance already in the schema, but adds the detail 'including member count' which hints at output structure. This adds value beyond the schema, earning a score above baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get full details') and the resource ('specific group'), including the specific output detail 'member count'. It also distinguishes between on-prem and Azure AD by providing identifier guidance, which helps differentiate this tool from siblings like 'get_group_members' or 'list_groups'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use CN/sAMAccountName vs display name/object ID based on the source, which is helpful for correct parameter usage. However, it does not explicitly compare this tool to alternatives (e.g., when to use 'get_group' vs 'get_group_members'), missing an opportunity to prevent misuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_group_membersA
List all members of a group with user details. Supports recursive expansion of nested groups for on-prem AD.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | Yes | Group name (CN/sAMAccountName) for on-prem AD, or display name/object ID for Azure AD | |
| recursive | No | Recursively expand nested groups to return all transitive members (on-prem AD only) | |
| max_results | No | Maximum number of members to return | |
| source | No | Data source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure) | ad |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden for behavioral traits. It discloses recursive expansion but omits details like pagination, rate limits, authentication, or output structure (e.g., what 'user details' include). Essential behavioral context is lacking.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no extraneous information. The first sentence states the core purpose, and the second adds the key special feature (recursive expansion). Excellent conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the basic function and a key feature, but lacks explanation of the return value (output structure). Since there is no output schema, the description should clarify what 'user details' means. Some aspects (like max_results behavior) are left to the schema. Overall adequate but with gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema fully describes all four parameters. The description adds no new meaning beyond what's in the schema (e.g., 'recursive' is already documented). With high coverage, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool lists group members with user details and supports recursive expansion for on-prem AD. It distinguishes from siblings like get_group (group properties) and get_user_groups (user's groups) by focusing on member listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing group members and mentions recursive expansion, but it does not explicitly state when to use this tool versus alternatives (e.g., 'use get_group for group properties'). Context from sibling tools provides implicit guidance, but explicit when-not or alternatives are missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_ouA
Get details of a specific organizational unit including child object counts.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | OU name (ou attribute value, e.g. 'Servers') or partial distinguished name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It implies a read operation but does not explicitly state it's read-only, nor does it discuss error handling, permissions, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that conveys the tool's purpose efficiently, with no redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the key output element (child object counts), but without an output schema, it could list additional details returned (e.g., name, description, path). Adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes the 'name' parameter, but the description adds valuable context: 'OU name (ou attribute value, e.g. 'Servers') or partial distinguished name', clarifying acceptable input formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'details of a specific organizational unit including child object counts'. It distinguishes from sibling tools like list_ous and search_ous by focusing on a single OU.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Despite sibling tools like list_ous and search_ous, the description does not mention when to prefer this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_userA
Get full details of a specific user. For on-prem AD use sAMAccountName; for Azure AD use UPN or object ID.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | Yes | sAMAccountName for on-prem AD, or UPN/object ID for Azure AD (e.g. jdoe or john.doe@company.com) | |
| source | No | Data source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure) | ad |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility for behavioral disclosure. It clarifies identifier format per source but does not explain what 'full details' entails, permissions needed, or any side effects. This is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no redundant information. The first sentence states the tool's purpose, and the second provides specific usage guidance. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity (2 parameters, 1 required, schema covers all), the description is sufficient for tool selection and invocation. While it doesn't describe the output format, the lack of an output schema is mitigated by the tool's straightforward nature.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the description adds limited value beyond the schema. It rephrases the identifier guidance, but the schema already includes similar details. With high coverage, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get full details of a specific user,' using a specific verb and resource. It also distinguishes usage between on-prem AD and Azure AD, differentiating it from sibling tools like get_user_groups or list_users.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on identifier selection per source (sAMAccountName for on-prem, UPN/object ID for Azure). It implies when to use this tool versus alternatives, but could be more explicit about when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_user_groupsA
List all groups a user is a member of (direct and via memberOf attribute).
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | Yes | sAMAccountName for on-prem AD, or UPN/object ID for Azure AD | |
| source | No | Data source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure) | ad |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must fully disclose behavioral traits. It mentions inclusion of transitive memberships (via memberOf), which is good, but omits details on auth requirements, rate limits, or output formatting.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no extraneous words. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with two well-documented parameters and no output schema, the description is mostly complete. It could mention error handling or pagination, but for typical use it's sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains the parameters. The tool description adds no additional parameter information, achieving only the baseline value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (list all groups), the target (a user), and the scope (direct and via memberOf). It distinguishes from sibling tools like get_group_members and other get/list tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving a user's group memberships but provides no explicit guidance on when to use this tool versus alternatives, such as get_group_members for the inverse operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_user_sign_in_activityA
Get last sign-in information for a user in Azure AD / Entra ID. Requires AuditLog.Read.All permission.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | Yes | User UPN (e.g. user@company.com) or object ID to retrieve sign-in activity for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description mentions the required 'AuditLog.Read.All' permission, which is a key behavioral trait. However, it does not describe the nature of the response (e.g., single object with fields) or any side effects. With no annotations, the burden is higher, but the permission detail adds value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that conveys the core action and a critical requirement, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description covers the essence: what the tool does and the key permission needed. It could optionally hint at the return format, but it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes the 'identifier' parameter fully (UPN or object ID). The description adds no additional meaning beyond the schema, so with 100% schema coverage, baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get last sign-in information for a user in Azure AD / Entra ID', providing a specific verb and resource that distinguishes it from sibling tools like get_user or get_device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description only mentions the required permission but does not provide explicit guidance on when to use this tool versus alternatives, nor does it exclude contexts where it would be inappropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_computersB
List computer accounts in Active Directory with OS, last logon, and OU information.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter by computer name (partial match) | |
| os | No | Filter by operating system (partial match, e.g. 'Windows Server 2022', 'Windows 10') | |
| max_results | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral transparency. It implies a read-only operation but does not disclose pagination behavior (though max_results parameter exists), rate limits, or potential performance impacts. The mention of returned fields (OS, last logon, OU) adds some value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence of 14 words that efficiently conveys the tool's purpose and key output fields. No redundant or extraneous information, and it is front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (3 parameters, no output schema, no annotations), the description is incomplete. It does not explain the output format, pagination handling, error cases, or how results are ordered. An agent would need additional context to reliably invoke this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear parameter descriptions. The tool description does not add extra semantic meaning beyond what the schema already provides, such as clarifying the format of filters or the effect of max_results. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it lists computer accounts in Active Directory with specific attributes (OS, last logon, OU). However, it does not explicitly differentiate from sibling tools like list_devices or search_computers, which have similar listing purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance provided. The description does not indicate when to use this tool over alternatives, such as search_computers for more advanced filtering or get_computer for a single computer, nor does it mention prerequisites or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_devicesB
List devices registered or joined in Azure AD / Entra ID with OS and compliance status.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter by device display name (partial match) | |
| os | No | Filter by operating system (e.g. 'Windows', 'iOS', 'Android', 'macOS') | |
| trust_type | No | Filter by trust type: AzureAD (Azure AD Joined), ServerAD (Hybrid Azure AD Joined), Workplace (Registered) | |
| enabled_only | No | Return only enabled/active devices | |
| max_results | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so description must carry burden. It mentions OS and compliance status as output, but lacks details on pagination, default filters, or rate limits. Adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no fluff. Could be reworded slightly for clarity (e.g., 'Lists all devices...') but overall concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, so description should clarify return format. It mentions OS and compliance status but omits ordering, pagination, and error conditions. Sufficient for basic understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all 5 parameters. The description adds marginal value by hinting at return fields (OS, compliance status), but does not enhance parameter understanding beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists devices in Azure AD/Entra ID with OS and compliance status, using a specific verb and resource. It distinguishes from sibling tools like get_device which retrieves a single device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description does not provide context for selection among siblings like list_computers or search_devices.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_groupsC
List Active Directory or Azure AD groups with optional name filter.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter by group name (partial match) | |
| max_results | No | Maximum number of results to return (default: 50) | |
| source | No | Data source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure) | ad |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It fails to mention whether the tool is read-only, pagination behavior, return value structure, or any side effects. For a listing tool, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core purpose without fluff. It could be slightly more information-dense while remaining concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters, no output schema, and no annotations, the description should elaborate on behavior, return format, pagination, or limitations. It is too sparse to be fully useful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are well-defined in the schema. The description adds minimal extra meaning (e.g., 'optional name filter') beyond what the schema already provides via descriptions and enums.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List Active Directory or Azure AD groups' with a specific verb and resource, and mentions an optional name filter. However, it doesn't distinguish from sibling tools like 'search_groups' or 'get_group', which share similar purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives like list vs search, or prerequisites for different sources. The description only states capability without usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_ousB
List organizational units (OUs) in Active Directory with their full path and details.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter by OU name (partial match) | |
| max_results | No | Maximum number of results to return (default: 100) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only says 'list' which implies read-only but does not disclose pagination, performance, or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, clear and to the point, no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description vaguely mentions 'full path and details' without specifying structure, and lacks details on result format or constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% description coverage; description adds 'full path and details' but does not significantly enhance understanding beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it lists organizational units with additional context ('full path and details'), and is distinguishable from sibling tools like get_ou or search_ous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like search_ous or list_groups; simple listing without usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_service_principalsA
List app registrations and service principals (enterprise applications) in Azure AD / Entra ID.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter by display name (partial match) | |
| type | No | Filter by service principal type: Application, ManagedIdentity, Legacy, SocialIdp | |
| max_results | No | Maximum number of results to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behaviors. It only states 'List' without specifying read-only nature, permission requirements, pagination, or any side effects, providing minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that immediately communicates the tool's purpose without any extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is mostly complete for a simple list operation. It lacks mention of pagination, default limits, or behavior with large result sets, but is sufficient given the clear schema and lack of output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100 and parameters are described, the description adds no additional meaning beyond the schema. The mention of resource types provides some context, but no extra semantic enrichment.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the specific resources: 'app registrations and service principals (enterprise applications)' in Azure AD/Entra ID, distinguishing it from sibling tools that focus on computers, devices, groups, and users.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use instructions are given. The purpose implies usage for listing service principals, but no alternatives or exclusions are mentioned, leaving it to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_usersB
List Active Directory or Azure AD users with optional filters. Supports filtering by name, email, or department.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Filter string: name, email, or department to search for | |
| department | No | Filter by department (partial match) | |
| max_results | No | Maximum number of results to return (default: 50) | |
| source | No | Data source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure) | ad |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It only states the action and supported filter fields, lacking details on pagination, performance, authentication requirements, or what happens with large result sets.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two short sentences, covering the essential purpose without any wasted words. It is well-structured and easily readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of annotations and output schema, the description is minimal. It omits important context such as return format, ordering, default pagination behavior, or any limitations. A more complete description would address these aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are fully described in the schema. The description adds a brief summary of filter capabilities but does not provide additional semantic details beyond what the schema already offers, warranting a neutral score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists users from Active Directory or Azure AD with optional filters, which distinguishes its purpose from similar list tools for other resources like list_groups. However, it does not explicitly differentiate from search_users, but the verb 'list' implies a broader listing than searching.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing users with filters but does not provide explicit guidance on when to use this tool versus alternatives like search_users or get_user. No exclusions or alternative suggestions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_computersA
Search computer accounts by name, operating system, or organizational unit path.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Search by computer name (partial match) | |
| os | No | Search by operating system (partial match) | |
| ou | No | Filter by OU path — matches computers whose DN contains this string (e.g. 'OU=Servers') | |
| description | No | Search by description (partial match) | |
| dns_name | No | Search by DNS hostname (partial match) | |
| max_results | No | Maximum number of results |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must carry behavioral info. It describes search criteria but omits whether results are paginated, return format, or any rate limits. For a search tool with no output schema, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that directly states the tool's purpose and key search fields. No extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, so description should clarify return format. It does not. Six parameters are documented but max_results default is 50 with no pagination explanation. Sibling differentiation is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, baseline 3. The description adds marginal value for the OU parameter ('matches computers whose DN contains this string') but merely repeats schema descriptions for others.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches computer accounts using name, OS, or OU path. It differentiates from siblings like 'get_computer' (single retrieval) and 'list_computers' (likely lists without search).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for searching but does not explicitly state when to use this tool versus alternatives like 'get_computer' or 'list_computers'. No exclusions or when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_groupsC
Search groups by name or description.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Search by group name (partial match) | |
| description | No | Search by description (partial match, on-prem AD only) | |
| max_results | No | Maximum number of results | |
| source | No | Data source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure) | ad |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits like read-only nature, pagination, rate limits, or any side effects. The description alone is insufficient for an agent to understand the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, but it lacks important details about parameters and usage. It is not overly verbose, but it sacrifices completeness for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the four parameters and no output schema or annotations, the description is incomplete. It does not explain how the 'source' parameter affects behavior, the default source, or that name and description are optional filters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description's mention of searching by name or description adds little beyond the schema. The description does not elaborate on parameter interactions or provide additional context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'search' and the resource 'groups', and specifies search criteria (name or description). It is distinct from sibling tools like search_users or search_ous, though it could explicitly mention that it returns groups.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as list_groups or get_group. There is no mention of prerequisites, context for use, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_ousC
Search organizational units by name or description.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Search by OU name (partial match) | |
| description | No | Search by description (partial match) | |
| parent | No | Filter by parent path — matches OUs whose DN contains this string (e.g. 'DC=corp,DC=example,DC=com') | |
| max_results | No | Maximum number of results |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden for behavioral disclosure. It only states the purpose and does not mention pagination, case sensitivity, match behavior, or any side effects. Minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loading the purpose. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 4 parameters, no output schema, and no annotations, the description is too sparse. It does not explain return format, default behavior, or search nuances, making it incomplete for an AI agent to use correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and all parameters have descriptions in the schema. The description does not add any new meaning beyond the schema. Per guidelines, baseline is 3 for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'search' and the resource 'organizational units', and specifies criteria by name or description. It distinguishes from list_ous and get_ou, but does not explicitly differentiate from other search tools like search_computers or search_groups.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like list_ous, get_ou, or other search tools. An AI agent would need to infer usage from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_usersB
Advanced user search by any field: name, email, department, job title, or phone number.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Search by display name or CN (partial match) | |
| No | Search by email address (partial match) | ||
| department | No | Search by department (partial match) | |
| title | No | Search by job title (partial match) | |
| phone | No | Search by telephone number (partial match) | |
| upn | No | Search by User Principal Name (partial match) | |
| max_results | No | Maximum number of results | |
| source | No | Data source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure) | ad |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description carries full burden. Only states it's an 'advanced search' but omits behavioral details like result format, pagination, or side effects. Partial match behavior is only in schema, not description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is front-loaded with key action and resource. No unnecessary words, perfectly concise for a straightforward search tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 8 parameters and no output schema, description fails to explain return values, sorting, pagination, or other search behavior. Incomplete for an advanced search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. Description adds value by listing fields in context but does not significantly enhance understanding beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly specifies the verb 'search' and resource 'users', lists multiple searchable fields (name, email, etc.), and distinguishes from siblings like 'list_users' and 'get_user' by emphasizing advanced search capabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as 'get_user' for exact match or 'list_users' for listing. Does not mention when not to use or any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
18 tool updates
v1.0.0- First observed
get_computer - First observed
get_device - First observed
get_group - First observed
get_group_members - First observed
get_ou - First observed
get_user - First observed
get_user_groups - First observed
get_user_sign_in_activity - First observed
list_computers - First observed
list_devices - First observed
list_groups - First observed
list_ous - First observed
list_service_principals - First observed
list_users - First observed
search_computers - First observed
search_groups - First observed
search_ous - First observed
search_users
TDQS
Each tool targets a distinct resource type or operation (e.g., get vs list vs search, computer vs device, group vs group members). There is no ambiguity between tools.
All tool names follow the verb_noun pattern consistently (e.g., get_computer, list_users, search_groups). No mixing of naming conventions.
18 tools cover both on-prem AD and Azure AD resources (users, groups, computers, devices, OUs, service principals) without being excessive. The scope is appropriate for a directory server.
The tool set is entirely read-only; there are no create, update, or delete operations. For an Active Directory server, this is a significant gap that prevents full lifecycle management.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- SkilderOAuthai.skilder
One place to build, share, and govern the skills and tools your AI agents use at work.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
Unified API to query AWS, GCP, Azure and generate Terraform/CLI execution kits for AI agents.
Related MCP Servers
- -licenseNot gradedqualityNot gradedmaintenanceProvides secure access to Microsoft Entra ID (Azure AD) resources including users, devices, and applications through Microsoft Graph API. Enables querying organizational data with comprehensive audit logging to Azure Blob Storage.-
- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with Microsoft Graph API services including Outlook email, Calendar events, OneDrive files, and Contacts. Supports multiple Microsoft accounts with unified search across all services.-
- FlicenseNot gradedqualityDmaintenanceConnects AI assistants to Microsoft 365 accounts to manage emails, calendars, files, and Teams messages. It offers 71 tools and supports multi-user environments through a secure, customizable server architecture.55-
- AlicenseNot gradedqualityDmaintenanceEnables managing Active Directory users, groups, and computers using natural language, with support for queries and updates.56MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/fredriksknese/mcp-activedirectory'
If you have feedback or need assistance with the MCP directory API, please join our Discord server